vodka / Luau obfuscator
A Luau obfuscator built for Luau. Current runtime, reproducible proof.
A free obfuscator for Luau source: encoded constants, flattened control flow and an opt-in per-function bytecode VM, differential-tested against the real Luau runtime so supported code runs the same.
Yours from
the first line.
Saved privately
Validated before publishing
Your next release, same address
Your release workflow / illustrated
The short version
Protection that understands Luau.
vodka protects Luau source, not just generic Lua. By default it encodes strings and numbers with a runtime-derived decode key, flattens control flow, renames locals and watermarks the output, as source-level changes that keep behavior intact and run within noise of native.
Because it targets Luau, it preserves what Luau programs rely on: type annotations including typeof(expr) are kept, string interpolation is handled at the source level, and globals, table fields, method names and type names are never renamed. It also offers a Lua 5.1 compatibility mode when you need it.
Verified behavior
Supported constructs are differential-tested against the real Luau runtime, so the protected script behaves like the original.
Constructs outside the supported set fall back to native execution, so behavior is preserved rather than guessed.
See the suite: reproducible benchmarks.
The strong option
An opt-in bytecode VM, when you need it.
Maximum protection
Turn on the per-function bytecode VM per script. Supported functions are compiled to bytecode and interpreted by a generated per-function virtual machine with self-integrity anti-tamper, on top of the default transformations.
Functions outside the supported set keep native execution, so behavior is preserved.
A cost you measure
The VM is off by default because interpreting bytecode is slower than native Luau, and that cost lands hardest on hot or looping code.
The benchmarks publish the overhead with the commands to reproduce it. Measure your own hot path before you enable it.
More than a transform
A platform, not a single step.
vodka is not only an obfuscator. The same workspace gives you a key system, HWID locking, per-key leak tracing, a stable loadstring, a Discord bot and a developer API, all free. Protection is where it starts, not where it ends.
You keep your original source, private and versioned, and you can restore an earlier version when you need to. There is no lock-in.
Where protection ends
Honest about the boundary.
No client-side obfuscator can make a delivered secret unrecoverable. An authorized client receives the code it runs, so running the loader can recover the strings and reverse the arithmetic. This is true of every obfuscator, vodka included, and we will not pretend otherwise.
What protection does is raise the cost of casual inspection and copying. What actually gates access is server-side: the key check, expiry, revocation and HWID locks are all enforced where the client never sees how the decision was made. Keep anything that must stay secret on a server, and read the benchmarks for exactly what the engine does and does not defeat.
Where to go next
Where to go next.
What the engine does
The protection pipeline layer by layer, and a plain account of what it does and does not defend against.
Reproducible benchmarks
Run the exact harness yourself: protection resistance, runtime overhead and the weaknesses we do not hide.
The obfuscator
Encoded constants, flattened control flow and an opt-in bytecode VM for your Roblox Lua and Luau scripts.
The key system
Free-key tasks, HWID locks, revocation and a Discord bot, enforced on the server rather than in the loader.
Guides and writing
Honest notes on protecting and shipping Luau: what the build does, and where client-side protection ends.
What it costs
Free for creators and players. Monetize with your own ad-link provider; the platform never holds the money.
Questions
A few things worth knowing.
01Is vodka a free Luau obfuscator?
Yes. Obfuscating Luau source with vodka is free, in the browser, with nothing to install. You also get a stable loadstring, an optional key system, HWID locking and a Discord bot at no cost.
02Does it understand Luau-specific syntax?
Yes. vodka targets Luau: type annotations including typeof(expr) are preserved, string interpolation is handled at the source level, and globals, table fields, method names and type names are never renamed. There is also a Lua 5.1 compatibility mode.
03How do you know it does not break my script?
Supported constructs are differential-tested against the real Luau runtime, so protected code behaves like the original. Constructs outside the supported set fall back to native execution. You should still test your own release in its target environment before shipping it.
04What is the opt-in bytecode VM?
Maximum protection compiles supported functions to bytecode run by a generated per-function virtual machine with anti-tamper, on top of the default source transformations. It is the strongest option and is off by default because it is slower than native. Measure your hot path with the published benchmarks before enabling it.
Keep building
Your next release starts here.
Bring your original source. Make the workspace your own.